Invoice Fraud

Invoice fraud is when a stranger sends you a bill that looks real and asks you to pay it into a different bank account. Usually it comes from a supplier you already use. Usually the amount is one you were expecting. That is exactly why it works.

The email looks identical to the ones you have had for years because, in a sense, it is. Someone has been reading your supplier's mailbox quietly for weeks. He waits for a genuine invoice to go out, copies it, changes two lines of bank details and sends it again from an address one letter different. Same logo, same layout, same signature, even the same old typo in the footer.

Sometimes there is no fake address at all. The mailbox itself is under his control, so the message truly does come from your supplier's own account and passes every check your email provider makes. So the sentence “but it came from the right address” proves nothing. It is the most expensive misunderstanding in small-business finance.

The habit that catches it is dull and cheap. No bank account is ever changed because an email asked for it. One person requests the change, a second person confirms it by phone on the number already saved for that supplier, and only then does the payment go out. Two people, one call. Linkysoft asks a new client whether that rule exists before looking at anything technical. Firms that lose six figures nearly always had one tired person doing both jobs late in the month.

Put the rule inside the software instead of in a policy nobody reads. When Linkysoft builds a finance screen as part of a business web application, a changed bank account freezes that supplier until a second named user approves it, and the old details stay on screen beside the new ones. The system keeps who changed what and when, which is the first thing your bank will ask you for.

If it has already happened, speed matters more than blame. Call your bank within the hour and ask for a recall, then warn the supplier, because their mailbox is the open one and their other customers are next. A security review afterwards is worth the money, but how much you get back depends on that first phone call.